Using RSA Algorithms with CBOR Object Signing and Encryption (COSE) Messages
Extracted elements (22)
Multi-prime RSA (modulus with more than two prime factors) is supported because it provides lower computational cost for decryption and signature primitives. The 'other' field and associated r_i/d_i/t_i parameters exist to encode the additional prime factors.
RSAES-OAEP with RFC 8017 default parameters (SHA-1) is included despite SHA-1 being older because it is the most widely implemented set of OAEP parameter choices, enabling broad interoperability.
The mask generation function for both RSASSA-PSS and RSAES-OAEP is fixed to MGF1 (as defined in RFC 8017) using the same hash function as used for data hashing. This simplifies parameterization and is the recommended practice to mitigate hash substitution attacks.
This specification follows the naming conventions of RFC 8017 (PKCS #1) for RSA key fields, and the corresponding fields have identical semantics to those defined in RFC 8017.
A key size of 2048 bits or larger MUST be used with these RSA algorithms. This corresponds roughly to 128-bit symmetric security strength.
All numeric RSA key parameters MUST be encoded using the minimum number of octets needed to represent the value as an unsigned big-endian octet sequence in CBOR byte string type.
For all RSA keys, 'kty' MUST be present and MUST have a value of 3. For public keys, 'n' and 'e' MUST be present, and all other key fields MUST be absent.
For RSA private keys with two primes, 'other', 'r_i', 'd_i', and 't_i' MUST be absent; all other fields MUST be present. For private keys with more than two primes, all fields MUST be present.
Implementations MUST check that the key type is 'RSA' (kty value 3) when creating or verifying an RSASSA-PSS signature.
Implementations SHOULD be able to encrypt and decrypt with RSA moduli between 2048 and 16K bits in length.
Keys used with RSAES-OAEP MUST follow the constraints in Section 7.1 of RFC 8017. Keys with a low private key exponent value (as described by Boneh) MUST NOT be used.
The key type MUST be 'RSA' when using RSAES-OAEP key encryption.
A new COSE key type 'RSA' is defined with the integer value 3. It is used as the 'kty' member of a COSE_Key object to identify RSA keys.
Three RSAES-OAEP key encryption algorithm identifiers are defined: value -40 (SHA-1, RFC 8017 default parameters), value -41 (SHA-256), and value -42 (SHA-512). All use MGF1 with the same hash as h, and encoding parameters P is always the empty octet string.
Three RSASSA-PSS algorithm identifiers are defined for COSE: PS256 (value -37, SHA-256, salt length 32), PS384 (value -38, SHA-384, salt length 48), and PS512 (value -39, SHA-512, salt length 64). All use MGF1 as the mask generation function with the same hash as used for data hashing.
Six algorithm identifiers are registered in the IANA 'COSE Algorithms' registry: PS256 (-37), PS384 (-38), PS512 (-39) for RSASSA-PSS, and RSAES-OAEP w/ default parameters (-40), w/ SHA-256 (-41), w/ SHA-512 (-42). All are marked Recommended: Yes.
The RSA key type with value 3 is registered in the IANA 'COSE Key Types' registry.
Twelve RSA key parameter entries (n, e, d, p, q, dP, dQ, qInv, other, r_i, d_i, t_i with labels -1 through -12) are registered in the IANA 'COSE Key Type Parameters' registry for key type 3.
Denial-of-service attacks can be mounted using overly large or oddly sized RSA keys that consume excessive resources. It is highly recommended that key length checks be performed before starting any cryptographic operation, and that a key not be used until it has been verified as controlled by a trusted party.
RSAES-OAEP with RFC 8017 default parameters uses SHA-1, which is included for interoperability as the most widely implemented OAEP parameter choice. Keys with low private exponent values MUST NOT be used as they are vulnerable to known attacks on the RSA cryptosystem.
There is a theoretical hash substitution attack against RSASSA-PSS; the mitigation is requiring the same hash function be used consistently for all operations. Unlike ECDSA, hash outputs are not truncated, and RSASSA-PSS's internal padding structure requires multiple collisions to forge a signature by changing hash functions, making this attack highly unlikely.
RSA key parameters are encoded as CBOR byte strings (major type 2) with integer labels: n (-1), e (-2), d (-3), p (-4), q (-5), dP (-6), dQ (-7), qInv (-8), other (-9, array), r_i (-10), d_i (-11), t_i (-12). All numeric parameters use unsigned big-endian representation.